CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-34716

High Severity
Prestashop
SVRS
63/100
CVSSv3
6.1/10
EPSS
0.10489/1

CVE-2024-34716 is a cross-site scripting (XSS) vulnerability in PrestaShop that can lead to significant security breaches. This flaw exists in versions 8.1.0 through 8.1.5 when the customer-thread feature flag is enabled. An attacker can exploit this by uploading a malicious file through the front-office contact form. When an administrator opens this file in the back office, the embedded XSS script executes. The malicious script can then access the administrator's session and security token, allowing unauthorized actions. With an SVRS of 63, while not critical, this vulnerability presents a substantial risk, especially given active exploits available. Due to the presence of active exploits, patching to version 8.1.6 or disabling the customer-thread feature flag is strongly advised to prevent potential account compromise and system-wide manipulation. Immediate action is needed to mitigate potential data breaches and maintain the integrity of the e-commerce platform.

TAGS
In The Wild
Exploit Avaliable
VECTOR STRING
CVSS:3.1
AV:N
AC:L
PR:N
UI:R
S:C
C:L
I:L
A:N
PUBLICATION DATE2024-05-14
LAST MODIFIED2025-01-21
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-34716 is a critical cross-site scripting (XSS) vulnerability affecting PrestaShop e-commerce platforms with the customer-thread feature enabled. This vulnerability allows attackers to execute malicious scripts in the context of an administrator's session, enabling them to perform any authenticated action. The SVRS score of 36 indicates a moderate risk, highlighting the need for prompt attention.

Key Insights

  • High Impact: The vulnerability grants attackers complete control over the affected PrestaShop instance, allowing them to steal sensitive data, modify settings, or even compromise the entire system.
  • Active Exploitation: Active exploits have been published, indicating that attackers are actively targeting this vulnerability.
  • CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning, urging organizations to take immediate action to mitigate the risk.
  • In the Wild: The vulnerability is actively exploited by hackers, making it crucial for organizations to address it promptly.

Mitigation Strategies

  • Update PrestaShop: Install the latest PrestaShop version (8.1.6) to patch the vulnerability.
  • Disable Customer Thread Feature: If updating is not immediately possible, disable the customer-thread feature flag to mitigate the risk.
  • Implement Web Application Firewall (WAF): Deploy a WAF to block malicious requests and prevent XSS attacks.
  • Regular Security Audits: Conduct regular security audits to identify and address any potential vulnerabilities.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.

Indicators of Compromise

No IOCs found for this CVE

Exploits

TitleSoftware LinkDate
aelmokhtar/CVE-2024-34716_PoChttps://github.com/aelmokhtar/CVE-2024-34716_PoC2024-05-14
Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-34716 | PrestaShop up to 8.1.5 cross site scripting
vuldb.com2025-03-30
CVE-2024-34716 | PrestaShop up to 8.1.5 cross site scripting | A vulnerability was found in PrestaShop up to 8.1.5 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2024-34716. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com
rss
forum
news

Social Media

Trickster is a medium machine from @hackthebox_eu:CVE-2024-34716 (PrestaShop XSS to RCE)=>extracting database creds=>exploit internally ChangeDetection instance(CVE-2024-32651)=>extract instance backups=>exploit a PrusaSlicer Arbitrary Code Execution=>root https://t.co/o7WPxeo02h
0
0
1
🗣 CVE-2024-34716: Critical Security Vulnerability Uncovered in PrestaShop https://t.co/hhKQUBcPMu #security #cybernews #cybersecurity #fridaysecurity #linkedin #twitter #telegram
0
0
0
The PrestaShop project, a leading open-source e-commerce platform powering over 300,000 web stores globally since 2007, has recently issued a security advisory revealing two significant vulnerabilities CVE-2024-34717, CVE-2024-34716 (CVSS 9.7) https://t.co/N0i8KMP6MD
0
0
0
Just uncovered a fascinating technical details on my latest finding on https://t.co/v8kRj9VtCI CVE-2024-34716: a PNG-driven XSS to RCE chain on PrestaShop (<=8.1.5). https://t.co/hcobzYLzxW
0
0
0

Affected Software

Configuration 1
TypeVendorProduct
AppPrestashopprestashop

References

ReferenceLink
[email protected]https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6
[email protected]https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78
AF854A3A-2127-422B-91AE-364DA2661108https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6
AF854A3A-2127-422B-91AE-364DA2661108https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78
[email protected]https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6
[email protected]https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78

CWE Details

CWE IDCWE NameDescription
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence